Linux Run Command As Another User

by on July 20, 2012 · 8 comments· LAST UPDATED July 20, 2012

in Command Line Hacks

Dear nixCraft,

I just want to know how to run Linux commands as another user or as root user?

Sincerely,
Confused About Linux commands.

Dear Confused,

You can use the following commands to run as another user or as root user.

#1: runuser command

The runuser command run a shell with substitute user and group IDs. This command is useful only when run as the root user:

Only session PAM hooks are run, and there is no password prompt. If run as a non-root user without privilege to set user ID, the command will fail as the binary is not setuid. As runuser doesn’t run auth and account PAM hooks, it runs with lower overhead than su.

The syntax is:

 
runuser -l  userNameHere -c 'command'
runuser -l  userNameHere -c '/path/to/command arg1 arg2'
 

For example, as a root user you may want to check shell resource limits for oracle user, enter:
# runuser -l oracle -c 'ulimit -SHa'
OR check nginx or lighttpd web server limitations:
# runuser -l nginx -c 'ulimit -SHa'
OR
# runuser -l lighttpd -c 'ulimit -SHa'
Sometime, a root user can not browse NFS mounted share due to permission (security) issue:
# ls -l /nfs/wwwroot/cyberciti.biz/http
OR
# cd /nfs/wwwroot/cyberciti.biz/http
Sample outputs:

-bash: cd: /nfs/wwwroot/cyberciti.biz/http/: Permission denied

However, apache user is allowed to browse or access nfs based system mouted at /nfs/wwwroot/cyberciti.biz/http/:
# runuser -l apache -c 'ls -l /nfs/wwwroot/cyberciti.biz/http/'
OR
# runuser -l apache -c 'cd /nfs/wwwroot/cyberciti.biz/http/; vi index.php'
No password is required to use runuser command and it must be run by root user only.

Options

  1. The -l option : Make the shell a login shell, uses runuser-l PAM file instead of default one.
  2. The -g group : Specify the primary group.
  3. The -G group : Specify a supplemental group.
  4. The -c COMMAND : Pass a single COMMAND to the shell with -c.
  5. --session-command=COMMAND : Pass a single COMMAND to the shell with -c and do not create a new session.
  6. -m : Do not reset environment variables.

#2: su command

The su command allows you to become a super user or substitute user, spoof user, set user or switch user. It allows a Linux user to change the current user account associated with the running console or shell provided that you know the target user's password. The syntax is as follows:

 
su -
su - username
 

Switching to root user

su command asks for the target user's password. Type su - at your shell prompt to switch to root user account (you must know the root user account password):
vivek@wks01:~$ su -
OR
vivek@wks01:~$ su - root
Sample outputs:

Password:
root@wks01:/root# logout
vivek@wks01:~$

If the correct root password is provided, ownership of the session is changed to root account. Type logout exit a root login shell. Type whoami or id command to verify the owner of a session:
whoami
OR
id

Run command as root user

The syntax is:

 
su - root -c "command"
OR
su - -c "command arg1"
 

To view the contents of /root directory which is not accessible to normal users, run:

 
su - root -c "ls -l /root"
 

Please note that Linix and some Unix-like systems have a wheel group of users, and only allow these users to su to root.

Run command as another user using su command

The following command switches to user oracle's account and shows a list of limits:
$ su - oracle -c 'ulimit -aHS'
Again, if the correct oracle password is provided, ownership of the session is changed to oracle account. The log of su command is kept in a system log, typically in /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL/CentOS).

#3: sudo command

sudo executes a command as another user but follows a set of rules about which users can execute which commands as which other users. This is configured in a filed named /etc/sudoers. Unlike su, sudo authenticates users against their own password rather than that of the target user. Sudo allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments. This allow the delegation of specific commands to specific users on specific hosts without sharing passwords among them. The syntax is as follows:

 
sudo command
 

See the following links for more information:

A note about GUI tools ( GUI frontend for su and sudo )

gksu command is a frontend to su and gksudo is a frontend to sudo. heir primary purpose is to run graphical commands that need root without the need to run an X terminal emulator and using su directly. The syntax is as follows:

 
gksu [-u <user>] [options] <command>
gksudo [-u <user>] [options] <command>
 

Just type gksu and you will be prompted as follows:

Linux gksu: Run Command As Root User Using Gnome GUI

Fig.01: gksu in action

You will be prompted for root user's account password:

Gnome gksu Command

Fig.02: Gnome gksu authentication box for the target user

You can run command directly as follows:
gksu -u root 'ls /root'
OR run command as oracle user:
gksu -u oracle 'ulimit -aHS'
OR
OR login as root:
gksu -u root -l

Summary: runuser vs su vs sudo

CommandRoot to userUser to rootAny to any userAuth typeLog fileRemark
runuserYNNNoneN/AAs runuser doesn't run auth and account PAM hooks, it runs with lower overhead than su.
suYYYTarget user's password/var/log/auth.log or /var/log/secureYou must share your password or root password with other users.
sudoYYYAuthenticates users against their own password rather than that of the target user./var/log/auth.log or /var/log/secureAllows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands.

See man pages for more information about su, sudo, gksu, and gksudo commands.

Sincerely,
nixCfraft

TwitterFacebookGoogle+PDF versionFound an error/typo on this page? Help us!

  • gregf

    Where does runuser come from? None of my boxes seem to have it.

  • http://www.cyberciti.biz/tips/about-us Vivek Gite

    $ rpm -qf /sbin/runuser
    coreutils-8.4-19.el6.x86_64

  • roozbeh

    I often use
    sudo -u USERNAME -i
    or
    sudo -u USERNAME -s

    to switch different user and then run my commands as that user.

  • Pierre B.

    I personnaly use the su – -c as an administrator, but the sudo is a very handy tool for end-users when correctly configured.

  • Prasad

    Best doc.

  • ScholesC

    god doc :)
    runuser is good …
    we can use it in script
    #!/sbin/runuser username

  • cpss454

    Just a tip: When issuing the runuser command I usually use the -c option, and I always use double quotes instead of single quotes around the command to be ran. This allows me to use single quotes within the double-quoted command to pass a quoted argument.
    For example, the following will not work because of nested single quotes:
    runuser -l fred -c ‘find /foo/foobar -name ‘*.txt”
    (two single quotes at the end of the line)
    This example uses double quotes and it works fine:
    runuser -l fred -c “find /foo/foobar -name ‘*.txt’”
    (a double-quote before “find”, single quotes around ‘*.txt’ and a double quote at the end of the line)
    If you want to know WHY this works, the shell processes command lines with double quotes twice. The first pass lets the interpreter know that anything within double quotes is an argument and that any single quotes within the double qutes are to be taken literally.

  • cpss454

    A caution about using runuser: Any command executed with runuser gets placed in the background by default. This means multiple runuser commands ran one after the other will each run in parallel. Use the -l (minus el) option to force runuser to run the command inside a shel, and thus wait for it to finish.

Previous post:

Next post: